Turla STOCKSTAY WebSocket C2 Communication to Known IOC Domains

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

This rule identifies network connections (DNS queries, HTTPS/WebSocket traffic) directed toward known suspicious domains associated with potentially malicious C2 infrastructure.